Overview
- Two independent reports published November 6 show most large-company AI systems can act without routine human approval and 87% of decision-makers say approval and monitoring must improve.
- About 47% of security leaders reported a sensitive-data exposure via an AI tool and 77% of those incidents involved company-approved services, showing policies alone are not stopping leaks.
- Researchers found major visibility gaps: 62% of firms can name users or departments that send data to AI, but only 48% can record the types of data that left the organization.
- Autonomous agents are a particular blind spot: 56% of respondents said agents acting for employees fall outside existing controls and many firms lack the technical ability to block or restrict unsanctioned tools.
- Companies are investing in governance and vendors are adding agent-specific controls, but experts warn that uneven adoption and past costly remediations mean regulators may demand stricter enforcement and reporting.